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It is an amazing fact that remarkably complex behaviors could emerge from a large collection of very 
rudimentary dynamical agents through very simple local interactions. However, it still remains elusive on 

o\ : 

how to design these local interactions among agents so as to achieve certain desired collective behaviors. 
This paper aims to tackle this challenge and proposes a divide-and-conquer approach to guarantee 
specified global behaviors through local coordination and control design for multi-agent systems. The 
basic idea is to decompose the requested global specification into subtasks for each individual agent. It 
should be noted that the decomposition is not arbitrary. The global specification should be decomposed 
in such a way that the fulfillment of these subtasks by each individual agent will imply the satisfaction 
of the global specification as a team. Formally, a given global specification can be represented as an 
automaton A, while a multi-agent system can be captured as a parallel distributed system. The first 
question needs to be answered is whether it is always possible to decompose a given task automaton 
A into a finite number of sub-automata Ai, where the parallel composition of these sub-automata Ai 
is bisimilar to the automaton A. First, it is shown by a counterexample that not all specifications can 
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be decomposed in this sense. Then, a natural follow-up question is what the necessary and sufficient 
conditions should be for the proposed decomposability of a global specification. The main part of 
the paper is set to answer this question. The case of two cooperative agents is investigated first, and 
necessary and sufficient conditions are presented and proven. Later on, the result is generalized to the 
case of arbitrary finite number of agents, and a hierarchical algorithm is proposed, which is shown to 
be a sufficient condition. Finally, a cooperative control scenario for a team of three robots is developed 
to illustrate the task decomposition procedure. 

I. Introduction 

Strongly driven by its great potential in both civilian and industrial applications (T), 10, 
multi-agent systems has rapidly emerged as a hot research area at the intersection of control, 
communication and computation 0, 01, JH, J6]|. The key issue in multi-agent system design is 
how to explicitly set the local interaction rules such that certain desirable global behaviors can be 
achieved by the team of cooperative agents0. Although it is known that sophisticated collective 
behaviors could emerge from a large collection of very elementary agents through simple local 
interactions, we still lack knowledge on how to change these rules to achieve or avoid certain 
global behaviors. As a result, it still remains elusive on how to design these local interaction rules 
so as to make sure that they, as a group, can achieve the specified requirements. In addition, 
we would like to point out that the desired collective behavior for a group of mobile agents 
could be very complicated, and might involve the coordination of many distributed independent 
and dependent modules in a parallel and environmental awareness manner. Hence, it poses new 
challenges that go beyond the traditional path planning, output regulation, or formation control[8J, 

da, on, a. 

This paper aims to propose a decomposition approach applicable in divide-and-conquer design 
for cooperative multi-agent systems so as to guarantee the desired global behaviors. The core 
idea is to decompose a global specification into sub-specifications for individual agents, and 
then design local controllers for each agent to satisfy these local specifications, respectively. The 
decomposition should be done in such a way that the global behavior is achieved provided that 
all these sub-specifications are held true by individual agents. Hence, the global specification 
is guaranteed by design. In order to perform this idea, several questions are required to be 
answered, such as how to describe the global specification and subtasks in a succinct and formal 



way; how to decompose the global specification; whether it is always possible to decompose, 
and if not, what are the necessary and sufficient conditions for decomposability. 

To formally describe the specification, a deterministic finite automaton is chosen here to 
represent the global specifications for multi-agent systems, due to its expressibility for a large 
class of tasks ifTTI . lfT2l . its similarity to our human logical commands, and its connection to 
the temporal logic specifications lfT3l . [fT4|l . Accordingly, we will focus on the logical behavior 
of a multi-agent system and model its collective behavior through parallel composition lfT5l . It 
is assumed that each agent is equipped with a local event set, containing both private events 
and common events (shared with other agents). Furthermore, it is assumed that the global task 
automaton is defined over the union of all agents' events. Then, the decomposition problem can 
be stated as follows. Given the global desired behavior represented as a deterministic automaton, 
how to obtain the local task automata from it such that the composition of the obtained local 
task automata is equivalent to the original global task automaton? 

Since the global task automaton is defined over the union of all agents' event sets, a reasonable 
way to obtain the local task automata is through natural projections with respect to each agent's 
event set. Namely, the agent will ignore the transitions marked by the events that are not in its 
own event set, i.e., blinds to these moves. The obtained automaton will be a sub-automaton of 
the global task automaton by deleting all the moves triggered by blind events of the agent. Given 
a task automaton and sets of local events, it is always feasible to do the projection operation, 
but the question is whether the obtained sub-automata preserve the required specifications in the 
sense that the fulfillment of each agent with its corresponding sub-task automaton will imply the 
satisfaction of the global specification as a group. Unfortunately, by a simple counterexample, 
it can be shown that the answer is not always. Then, a natural follow-up question is what 
the necessary and sufficient condition should be for the proposed decomposability of a global 
specification. The main part of the paper is set to answer this question. 

Similar automaton decomposition problem has been studied in the computer science literature. 
Roughly speaking, two different classes of problems have been studied, so far. The first problem 
is to design the event distribution so as to make the automaton decomposable, which is typically 
studied in the context of concurrent systems. For example, [16] characterized the conditions for 
decomposition of asynchronous automata in the sense of isomorphism based on the maximal 
cliques of the dependency graph. The isomorphism equivalence used in [Tl6l is however a strong 



condition, in the sense that two isomorphic automata are bisimilar but not vise versa IfTTTl . In 
many applications bisimulation relation suffices to capture the equivalence relationship. On the 
other hand, the second class of problems assumes that the distribution of the global event set is 
given and the objective is to find conditions on the automaton such that it is decomposable. This is 
usually called synthesis modulo problem lfT5l that can be investigated under three types of equiv- 
alence: isomorphism, bisimulation and language equivalence. Bisimulation synthesis modulo for 
a global automaton was addressed in ifTTll . by introducing necessary and sufficient conditions 
for automaton decomposition based on language product of the automaton and determinism of 
its bisimulation quotient. Obtaining the bisimulation quotient, however, is generally a difficult 
task, and the condition on language product relies on language separability lfT8l . which is another 
form of decomposability. These problems motivate us to develop new necessary and sufficient 
conditions that can characterize the decomposability based on the investigation of events and 
strings in the given automaton. 

In this paper, we identify conditions on the global specification automaton in terms of its 
private and common events for the proposed decomposability, which are shown to be necessary 
and sufficient for the case of two agents. Later on, the result is generalized to the case of 
arbitrary finite number of agents, and a hierarchical algorithm is proposed, which is shown to 
be a sufficient condition. Furthermore, it is shown that if the global task is decomposable, then 
designing the local controller for each agent to satisfy its corresponding sub-task will lead the 
entire multi-agent system to achieve the global specification. To illustrate the decomposition 
approach, a coordination and control scenario has been developed and implemented on a team 
of three robots. 

The rest of the paper is organized as follows. Preliminary lemmas, notations, definitions and 
problem formulation are represented in Section lU Section [III] introduces the necessary and 
sufficient conditions for decomposition of an automaton with respect to parallel composition and 
two local event sets. The algorithm for the hierarchical extension of the automaton decomposition 
is given in Section [IVj To illustrate the task decomposition, an implementation result is given 
on a cooperative multi-robot system example in Section |Vj Finally, the paper concludes with 
remarks and discussions in Section |VIJ The proofs of lemmas are given in the Appendix. 



II. Problem formulation 
We first recall the definition of an automaton |fl2|. 

Definition 1: (Automaton) An automaton is a tuple A = (Q, q , E, 5) consisting of 

• a set of states Q; 

• the initial state q G Q; 

• a set of events E that causes transitions between the states, and 

• a transition relation 5 C Q x E x Q such that (g, e, g') G 5 if and only if S(q, e) = g' (or 

g -> g )■ 

In general, automaton has also an argument which is the set of final or marked states, the 
states are marked when it is desired to attach a special meaning to them, such as accomplishing. 
This argument is dropped when the notion of marked state is not of interest or it is clear from 
the content. 

As 5 is a partial map from Q x E into Q, in general, not all states are reachable from the initial 
state. The accessible portion of the automaton is defined as 

Definition 2: (Accessible Operator; ifTTTO Consider an automaton A = (Q, q , E, 5). The oper- 
ator Ac(.) excludes the states and their attached transitions that are not reachable from the initial 
state, and is defined as Ac(A) = (Qac, go, E, 5 ac ) with Q ac = {g G Q\3s G E*, 5(q , s) = g} and 
S ac = $\Qac x E — >■ Q ac , restricting 5 to the smaller domain of Q ac . As AC{.) has no effect on 
the behavior of the automaton, from now on we assume A = Ac(A). 

The transition relation can be extended to a finite string of events, s G E*, where E* stands for 
Kleene — Closure of E (the set of all finite strings over elements of E), as follows 8(q, e) = q, 
and 5(q,se) = S(6(q,s),e) for s G E* and e G E. We focus on deterministic task automata 
that are simpler to be characterized, and cover a wide class of specifications. The qualitative 
behavior of a deterministic discrete event system (DES) is described by the set of all possible 
sequences of events starting from initial state. Each such a sequence is called a string, and the 
collection of strings represents the language generated by the automaton, denoted by L(A). Given 
a language L, L C E* is the prefix-closure of L defined as L = {s G E*\Bt G E*,st G L}, 
consisting of all prefixes of all the strings in L. The existence of a transition over string s G E* 
from a state q G Q, is denoted by 5(q, s)\, and considering a language L, by 5(q, L)\ we mean 
Vcj G L : 8(q,u)\. 



To describe the decompos ability condition in the main result and during the proofs, we define 
successive event pair and adjacent event pair as follows. 

Definition 3: (Successive event pair) Two events e% and e 2 are called successive events if 

3q E Q : 6{q, ei)! A 6{6{q, ex), e 2 )! or 5{q, e 2 )\ A 6{6{q, e 2 ), ei)!. 

Definition 4: (Adjacent event pair) Two events e\ and e 2 are called adjacent events if 3q E 

Q : <5(g,ei)! A%e 2 )!. 

To compare the task automaton and its decomposed automata, we use the simulation and 
bi simulation relations IfTTTl . 

Definition 5: (Simulation and Bisimulation) Consider two automata = (Qi, E, Si), i = 
1, 2. A relation i? C Q x x Q 2 is said to be a simulation relation from A\ to A 2 if 

1) (qlq^ER 

2) V (gi, q 2 ) E R, 5x(qx, e) = q[, then 3q' 2 E Q 2 such that 5 2 (q 2 , e) = q' 2 , (q[, q' 2 ) E R. 

If R is defined for all states and all events in A\, then A\ is said to be similar to A 2 (or A 2 
simulates A\), denoted by A\ -< A 2 [[TT|. 

If A\ -< A 2 , A 2 -< A\ and R is symmetric then A\ and A 2 are said to be bisimilar (bisimulate 
each other), denoted by A x = A 2 [fT9l . 

In general, bisimilarity implies languages equivalence but the converse does not necessarily 
hold true GUI 

Definition 6: (Isomorphism, (12111) Isomorphism is one of the strongest equivalences relations 
between automata. Two automata A4 = (Qi,qf, E,5i), i = 1,2, are said to be isomorphic, if 
there exists an isomorphism 9 from Ax to A 2 defined as a bijective function 9 : Qx — >■ Q 2 such 
that %°) = q° 2 , and 9(5x(q,e)) = 5 2 (9(q),e), Wq E Qx, e E E. 

By this definition, two isomorphic automata are bisimilar, but bisimilar automata are not 
necessarily isomorphic (see Example [3]). 

In this paper, we assume that the task automaton As and the sets of local events Ei are all 
given. It is further assumed that A s is deterministic while its event set E is obtained by the 
union of local event sets, i.e., E = Uj£Jj. The problem is to check whether the task automaton 
As can be decomposed into sub-automata As i on the local event sets Ei, respectively, such that 
the collection of these sub-automata A Si is somehow equivalent to A s . The equivalence is in the 
sense of bisimilarity as defined above, while the composition process for these sub-automata As i 
could be in the usual sense of parallel composition as defined below. Parallel composition is used 



V(gi, q 2 ) E Q,e E E : 5((q u q 2 ), e) 



(5 1 (q 1 ,e),6 2 {q2,e)) , if 



to model the interactions between automata and represent the logical behavior of multi-agent 
systems. Parallel composition is formally defined as 

Definition 7: (Parallel Composition [12]) Let A{ = (Qi,q®, Ei,5i), i = 1,2, be automata. 
The parallel composition (synchronous composition) of A x and A 2 is the automaton Ai||A 2 = 
(Q = Qi x Q 2 , q = (ql, gjj), E — E\ UE 2 , 5), with 5 defined as 

^i(?i,e)!,5 2 (g 2 ,e)!, 

e G -Ei n # 2 

(5i(gi,e),g 2 ) , if $l(<7i, e)!, e G E\\E 2 ; 

(qi, S 2 {q 2 , e)) , if 5 2 (g 2 , e)!, e G £ 2 \£i; 

undefined, otherwise 
The parallel composition of Aj, i = l,2,...,n is called parallel distributed system, and is 

n 

defined based on the associativity property of parallel composition |[TTj| as || A,- t = A\ || ... || 

i=i 

A n = A 1 || (A 2 || (■■• || (A n _i || A n ))). 

A reasonable guess for task automaton decomposition is to use natural projections with respect 
to agents' event set. Natural projection over strings is denoted by pe % = Pi '■ E* — >■ E*, takes 
a string from the event set E and eliminates events in it that do not belong to the event set 
Ei C E. The natural projection is formally defined on the strings as 

Definition 8: (Natural Projection on String, [CO) Consider a global event set E and its local 

n 

event sets Ei, i = l,2,...,n, with E = U Ei. Then, the natural projection pi : E* — )■ £"* is 

4 = 1 

inductively defined as 

Pi(e) = e; 

Pi(s)e if e E Ei 



\/s E E*,ee E : pi{se) 



Pi(s) otherwise. 



The natural projection is also defined on automata as Pi(As) : — >• A^, where, v4s t are 
obtained from A s by replacing its events that belong to -E^-Ej by r-moves (representing silent 
or unobservable transitions), and then, merging the r-related states. The r-related states form 
equivalent classes defined as follows. 

Definition 9: (Equivalent class of states, lfT6l ) Consider an automaton As = (Q, qo, E, S) and 

n 

local event sets E^ i = 1, 2, n, with E — U E^ Then, the relation ~ Ei (or ~j) is the least 

i=l 

equivalence relation on the set Q of states such that 8(q, e) = q' A e £ E^ q ~ E . q\ and 
[g]^ = [q]i denotes the equivalence class of q defined on ~ Ei. In this case, q and q' are said 



to be r-related. 

The natural projection is then formally defined on an automaton as follows. 

Definition 10: (Natural Projection on Automaton) Consider an automaton A s = (Q, g , E, 5) 

n 

and local event sets E u i = 1, 2, n, with E = U E { . Then, Pj(As) = (Qi = Q/~E t , [qolEi, Ei, 
with 5i([q] Ei ,e) = [g']^ if there are states q x an d q[ such that g x ~ E . g, g^ g' s and 

<5(gi,e) = g^. 

The following example elaborates the concept of natural projection on a given automaton. 
Example 1: Consider an automaton A s : • JL*. • with the event set E = E 1 U E 2 



t'4 



6 



and local event sets E\ = {a, b, e{\, E 2 = {a, b, e 2 ,e 4 }. The natural projections of A s into Ei 
is obtained as Pi (As): « ^_ j # by replacing {e 2 , e 4 } G E\Ei with r and merging the r- 



related states. Similarly, the projection P 2 (As) is obtained as P 2 (As): 



e 2 e 4 



To investigate the interactions of transitions in two automata, particularly in Pi(As) and 
^2 (As) » me interleaving of strings is defined, based on the path automaton as follows. 

Definition 11: (Path Automaton) A sequence q x —V g 2 % ... ^ q n is called a path automaton, 
characterized by its initial state gi and string s = e\e 2 ...e n , denoted by PA(q 1 ,s), and defined 
as PA(q h s) = ({q h q n }, {gi}, {ei, e n },5p A ), with 5 PA (qi,ei) = q i+1 , i = l,...,n- 1. 
PA^q'^s') is defined, similarly. 

Definition 12: (Interleaving) Given two sequences q x % q 2 % ... q n and q' x —V q' 2 -A- ... 
q' m , the interleaving of their corresponding strings, s = e\e 2 ...e n and s' = e' x e! 2 ...e' m , is denoted 
by s\s', and defined as s\s' = L{PA(q 1 ,s)\\PA(q' 1 ,s')}. 

Example 2: Consider three strings s\ = e x a, s 2 = ae 2 and s 3 = at\. Then the interleaving 
of s\ and s 2 is si|s 2 = ~e\ae 2 while the interleaving of two strings s 2 and S3 becomes s 2 \sz = 
{aeie 2 , ae 2 e x }. 

Based on these definitions, we are now ready to formally define the decomposability of an 
automaton with respect to parallel composition and natural projections as follows. 

Definition 13: (Automaton decomposability, or bisimulation synthesis modulo lfT5lO A task 



n 

automaton A s with the event set E and local event sets Ei, i = 1, n, E = U Ei, is said to be 

i=l 

decomposable with respect to parallel composition and natural projections Pj : As — > Pi (As), 



z = l,...,n, if || P l (A s ) = A s . 

Now, let us see a motivating example to illustrate the decomposition procedure. 

Example 3: Consider the task automaton A s and its local event sets in Example [IJ This au- 
tomaton is decomposable with respect to parallel composition and natural projections, since A s = 

Pi(A s )\\P 2 (As), leading to L{A S ) = L{P 1 {A 8 )\\P i {A s )) = {e, a, aei, aeifc, e 2 , e 2 e 4 , e 2 e 4 6}. 
Two automata 

and 



ei jQj^ e2 

® 61 



02 




with E = EiU E 2 , Ei = {a, ei}, P 2 = {a, e 2 } are other examples of decomposable automata. 

Note that, these two automata are bisimilar (with the bisimulation relation R = {(qo,q' ), (qi,qi)- 
(<?2, q 2 ), (<?3, 93)) (94> ^D) (?2) 95)) (^3, q'e)}\ but not isomorphic. The first one is concrete (decom- 
posable in the sense of isomorphism; satisfying FD (forward diamond) and ID (independent 
diamond)) as well as decomposable (in the sense of bisimulation). The latter automaton, on the 
other hand, is decomposable, but not concrete. 

Examples [3] shows a decomposable task automaton; however, to deal with the top - down 
design we need to understand whether any task automaton is decomposable or not. 

Problem 1: Given a deterministic task automaton A s and local event sets E{, % = 1, • • • , n, is 
it always possible to decompose A s with respect to parallel composition and natural projections 
Pi, i = 1, • • • ,n? 

To answer this question, we examine the following example. 

Example 4: Consider an automaton A s : 

_^ # # _fi. # , with local event sets E\ = {ei} and E 2 = {e 2 }. The parallel composition 
ofPi(As) : -^mXm andP 2 (A s ) : — • X • is Pi(A s )\\P 2 (A s ): _ . _!U . _f 



ea ei 

One can observe that A s -< Pi(A s )\\P 2 (As) but Pi(A s )\\P 2 (As) -fi A s leading to L(A S ) = 
{e,e u e x e 2 } C L(P 1 (As)\\P 2 (As)) = {e, e l5 ei e 2 , e 2 , e 2ei }, but L(Pi(A s )||P 2 (A s )) £ L(A S ). 
Therefore, v4 s is not decomposable with respect to parallel composition and natural projections 

Pi, i = 1,2. 



Therefore, not all automata are decomposable with respect to parallel composition and natural 
projections. Then, a natural follow-up question is what makes an automaton decomposable. It 
can be formally stated as follows. 

Problem 2: Given a deterministic task automaton As and local event sets Ei, i — 1, • • • , n, 
what are the necessary and sufficient conditions that A s is decomposable with respect to parallel 

n 

composition and natural projections Pj : As — > Pi (As), i = 1, • • • , n, such that || Pj (As) — 

i=i 

A s ? 

This problem will be addressed in the following two sections. In the next section, we will deal 
with the case of two agents and present necessary and sufficient conditions for decompos ability. 
Then, the result is generalized in Section|lV]to a finite number of agents, as a sufficient condition. 

III. Task decomposition for two agents 

In order for As = Pi(As)\\P2{As), from the definition of bisimulation, it is required to 
have A s -< Pi(As)\\P2(As); Pi(As)\\P2(A s ) -< As, and the simulation relations are symmetric. 
These requirements are provided by the following three lemmas. Firstly, the following simulation 
relationship always holds true. 

Lemma 1: Consider any deterministic automaton As with event set E = E\ U E 2 , local event 
sets Ei, and natural projections Pi, i = 1,2. Then A s -< Pi(As)||P 2 (As). 

Proof: See the Appendix for proof. ■ 

This lemma shows that, in general, Pi(As)||P 2 (As) simulates As. The similarity of Pi (A s ) \\P2(A S ) 
to As, however, is not always true (see Example SI), and needs some conditions as stated in the 
following lemma. 

Lemma 2: Consider a deterministic automaton As = (Q,qo,E = E\ U E 2 ,S) and natural 
projections P, . : A s -> Pi(A s ), i = 1,2. Then, Pi(A s )\\P 2 (A s ) -< A s if and only if A s satisfies 
the following conditions: Vei G E 1 \E 2 , e 2 G E 2 \Ei, q G Q, s G E*\ 

. DCl : [%, e x )! A %, e 2 )!] [5(q, ei e 2 )! A 5(q, e 2 e 1 )\]; 

• DC2 : 5(q, eie 2 s)! e 2 eis)!, and 

• DC3 : Vs, s' G P*, sharing the same first appearing common event a G E 1 fl P 2 , s 7^ s', 

g G Q: <%, s)! A s')! ^ %,Pi(s)b 2 (s'))! A %pi(s')ba(s))!. 

Proof: See the Appendix for proof. ■ 



Next, we need to show that the two simulation relations R x (for A s -< P 1 (A s )\\P 2 (As)) and 
R 2 (for P 1 (A S )\\P 2 (A S ) -< As), defined by the above two lemmas, are symmetric. 

Lemma 3: Consider an automaton A s = (Q,qo,E = E\ U E 2 ,5) with natural projections 
Pi : A s ->> P(As), z = 1,2. If A 5 is deterministic, A 5 -< Pi(v4 5 )||P 2 (Ay) with the simulation 
relation FL\ and Pi(As)\\P 2 (As) -< As with the simulation relation R 2 , then Pjf 1 = R 2 (i.e., 
Vg G Q, z G Z: (z,q) G R 2 (g, 0) G P x ) if and only if DC A: Vi G {1,2}, x,x 1 ,x 2 G Qi> 
xi 7^ x 2 , e G t G £■*, e) = x 1 , 5i(x, e) = x 2 : 5 i (x 1 ,t)\ ^ Si(x 2 , t)\. 

Proof: See the proof in the Appendix. ■ 

Based on these lemmas, the main result on task automaton decomposition is given as follows. 

Theorem 1: A deterministic automaton A s = (Q,qo,E — Ex U E 2 ,5) is decomposable with 
respect to parallel composition and natural projections Pi : As — > Pi(As), i = 1,2, such that 
A s = Pi(A s )\\P 2 (As) if and only if A s satisfies the following decomposability conditions (DC): 

Vd G E X \E 2 , e 2 G E 2 \E U qeQ,seE*, 

. DCl: [5(q,e 1 )\A5(q,e 2 )\]^[5(q,e 1 e 2 )\A5(q,e 2 e 1 )\\; 

• DC2: 5(q,e 1 e 2 s)\ 8(q 1 e 2 eis)\, and 

• DC3: Vs, s' G E*, sharing the same first appearing common event a G Ex n P 2 , s 7^ s '> 

g G Q: 5(q, s)\ A %, s')! => <%pi(s)b 2 (s'))! A <%Pi(s')b 2 (s))!; 

• DCA: Mi G {1,2}, x, Xi,x 2 G Qj, Xi 7^ x 2 , e G P^, t G P*, <5j(x,e) = Xi, <5j(x, e) = x 2 : 
5i(x!,t)! ^ 5i{x 2 ,t)\. 

Proof: According to Definitional A s = Pi(A s ) | |P 2 (A 5 ) if and only if A s -< Pi(A s ) \\P 2 {A S ) 
(that is always true due to Lemma©, Pi(A s )\\P 2 (A s ) -< A s (that it is true if and only if DC1, 
DC2 and DC3 are true, according to Lemma |2]) and the simulation relations are symmetric, i.e., 
R^ 1 = P 2 (that for a deterministic automaton As, when As -< Pi(As)\\P 2 (As) with simulation 
relation Ri and Pi(As)\\P 2 (A s ) -< A s with simulation relation R 2 , due to Lemma |3j R^ 1 = R 2 
holds true if and only if DC A is satisfied). Therefore, A s = Pi(A s ) \ \P 2 (A S ) if and only if DCl, 
DC2, DC3 and DC A are satisfied. ■ 
Remark 1: Intuitively, the decomposability condition DCl means that for any successive or 
adjacent pair of private events (ei,e 2 ) G {(E 1 \E 2 , E 2 \Ei), (P 2 \P 1; Ei\E 2 )} (from different 
private event sets), both orders e\e 2 and e 2 e\ should be legal from the same state, unless they 
are mediated by a common string. 



Furthermore, eie 2 and e 2 ei are not required to meet at the same state (unlike FD and ID in 
[16]); but due to DC2, any string s G E* after them should be the same, or in other words, if t\ 
and e 2 are necessary conditions for occurrence of a string s, then any order of these two events 
would be legal for such occurrence (see Example [3]). Note that, as a special case, s could be e. 

The condition DC3 means that if two strings s and s' share the same first appearing common 
event, then any interleaving of these two strings should be legal in As- This requirement is due 
to synchronization of projections of these strings in Pi(As) and P2(As). 

The last condition, DCA, ensures the symmetry of mutual simulation relations between A s 
and P\{As) | ^(As 1 )- Given the determinism of As, this symmetry is guaranteed when each local 
task automaton bisimulates a deterministic automaton, leading to the existence of a deterministic 
automaton that is bisimilar to Pi(A s )\\P 2 (As). If the simulation relations are not symmetric, 
then some of the sequences that are allowed in As will be disabled in P 1 (As)\ \P2{As) . 

The notion of language decomposability [|22l| is comparable with DC2 and means that any 
order of any successive events in any string of the language specification should be legal, or at 
least one of its projections (from the viewpoint of the corresponding local observer) should 
be capable of distinguishing this order. It also embodies a notion similar to DC3, stating 
that the global languages specification should contain all possible interleaving languages of 
all local languages. This notion, however, is not capable of capturing the other two conditions 
on the decision on the switch between adjacent transitions (DC1), and existence of deterministic 
bisimilar automata to Pi(A s ) and P 2 (A S ) (DCA). The automaton decomposability conditions in 
this result, in terms of bisimulation, besides checking the capability of local plants on decision 
making on the orders of event (DC2), they should also be capable of decision making on the 
switches (DC1), and moreover, the synchronization of local task automata should not lead to an 
illegal behavior(DC3), and also ensures that like As, Pi(As)||P 2 (As) a l so has a deterministic 
behavior (DC4). 

The decomposability conditions can be then paraphrased as follows: Any decision on order 
or switch between two transitions that cannot be made locally (by at least one local controller) 
should not be critical globally (any result of the decision should be allowed); and interpretation 
of the global task by the team of local plants should neither allow an illegal behavior (a string 
that is not in global task automaton), nor disallow a legal behavior (a string that appears in the 
global task automaton). 



The following four examples illustrate the decomposability conditions for decomposable and 
undecomposable automata. 

Example 5: This example illustrates the concept of decision making on switching between the 
events, mentioned in RemarkCQ Furthermore, it shows an automaton that satisfies DC2, DC3 and 
DCA, but not DC1, leading to undecomposability. The automaton A s : ^ # ei ? # with 



e 2 • 

local event sets E\ = {ei} and E 2 = {e 2 }, is not decomposable as the parallel composition of 
P X {A S ): — • X . mdP 2 (A s ) : — . X • is P 1 (A S )\\P 2 (A S ) : ^ • _!U • _X 



e2 ei 

which does not bisimulate A s . Here, A s is not decomposable with respect to parallel composition 
and natural projections Pi, i = 1, 2, since two events e\ G E 1 \E 2 and e 2 G E 2 \E t do not respect 
DC1, as none of the local plant takes in charge of decision making on the switching between 
these two events. One can observe that, if in this example ei e Ei\E 2 and e 2 G E 2 \E 1 were 
separated by a common event a G Ei D E 2 , then ^ # a ? # 62 , # with local 



event sets E\ = {e 1; a} and E 2 = {e 2 ,a}, was decomposable, since the decision on the switch 
between e\ and a could be made in Ei and then E 2 could be responsible for the decision on 
the order of a and e 2 . 

Example 6: The automaton A s in Example [3] shows an automaton that respects DC1, DC3 
and DC A, but is undecomposable due to violation of DC2. Here, A s is not decomposable 
since none of the local plants take in charge of decision making on the order of two events 
ei G Ei\E 2 and e 2 G E 2 \E\. If e\ G E\\E 2 and e 2 G E 2 \E\ were separated by a com- 
mon event a G i?i fl E 2 , then the automaton # # # # with local event sets 
Ei — { e i) a } an d -^2 = {e2,a}, was decomposable, since the decision on the orders of 
ei and a and then a and e 2 could be made in E\ and then E 2 , subsequently. As another 
example, consider an automaton As'. e • 62 , # a , # with E\ = {a, ei}, i?2 = 



{a,e 2 }, leading to P 1 {A s )\\P 2 {A s y. 



ei ei 



The transition 5\\(zo, e 2 eia)\ 



<-2 



<-2 



f e 2 f \e 2 

I ei ei I 

• * • 

I 6 2 1 1 £ 2 

» ei » ei » a 



in I |P 2 (yl5), but -^5(q , e 2 eia)! in A5. Therefore, is not decomposable. If the lower 

branch was continued with a transition on a after e 2 ei, then the automaton was decomposable 
(See Example [3]). 

Example 7: This example illustrates an automaton that satisfies DC1, DC2 and DCA, but it 
is undecompo sable as it does not fulfil DC3, since new strings appear in Pi(As)\\P 2 (A s ) from 
the interleaving of two strings in Pi(As) and P 2 (As), but they are not legal in As. Consider the 
task automaton A s : e * e with E\ = {a, ex}, E 2 = {a, e 2 }, leading 



e- 2 



tO Pi (Ac 



C2 



and 



C'L> 



P 1 (A S )\\P 2 (A S ): 



a £2 a £2 



# that is not bisimilar to A s since two strings e 2 a 



C 2 



a e2 



and eiae 2 are newly generated, while they do not appear in A s , although both Pi(A 3 ) and 
P 2 (v4s) are deterministic. 

Example 8: This example illustrates an automaton that satisfies DCl and DC2, and DC3, 
but is undecompo sable as it does not fulfil DC A. Consider the task automaton 

A s : ei (g)_!^(g_^(g) with E x = {a, b, e x }, E 2 = {a, b}, leading to 

® 



and 



Pi(As)\\P 2 (As): ei 0_i*@_l*(g) which is not bisimilar to A s . This task 



automaton As satisfies DCl and DC2 as contains no successive/adjacent transitions defined on 
different local event sets. But, it does not fulfil DC A, although any string in T = {pi(s)\p 2 (s') , 
Pi(s')\p 2 (s)} (s and s' are the top and bottom strings in A s and share the first appearing common 
event a G E 1 C]E 2 ), appears in As. The reason is that there exists a transition on string e^a from z 
to z 5 that stops in Pi(A s )\\P 2 (A s ), whereas, although e\a transits from q in As, it does not stop 
afterwards. This illustrate dissymmetry in simulation relations between A s and Pi(A s )\\P 2 (A s ). 
Note that As -< Pi(As)\\P2(As) with the simulation relation R\ over all events in E, from all 
states in Q into some states in Z, as R\ = {(q , z ), (qi, z\), (q 2 , z 2 ), (q 3 , z 3 ), (g 4 , z 4 )}. Moreover, 
Pi(As)\\P 2 (As) -< A s with the simulation relation R 2 over all events in E, from all states in 
Z into some states in Q, as R 2 = {(z , q ), (z 1 , q{), (z 2 , q 2 ), (z 3 , q 3 ), (z 4 , q 4 ), (z 5 , 92)}- Therefore, 
although A s -< Pi(A s )\\P2(A s ) and P 1 (A S )\\P 2 (A S ) -< A s , Pi(A s )\\P2(A s ) ¥ A s , since 
3(^5,92) € R2, whereas (q 2) z 5 ) ^ R±. If for stoping of string e±a in Pi(A s )\\P 2 (A s ), there was 
a state in Q reachable from q by e\a and stopping there, then we would have Vq e Q, z e Z : 
(q,z) ER^ (z,q) E R 2 and P 1 {A S )\\P 2 {A S ) = A s . 

It should be noted that the condition DCA not only applies for nondeterminism on common 
events, but also it requires any nondeterminism on private event also to have a bisimilar determin- 
istic counterpart. For example, consider the task automaton A s : • with 

>■ • • s~ • 



e 2 • • 

ei 

ei 



-Ei = {ei,a}, £2 = {e 2 , a}. The parallel composition of P\(As): ^ • 1 ~ » a ~ » (with 



ei 



nondeterministci transition on private event e\) and P 2 (A S ): ^ • a > • is Pi (As) \\P 2 (As): 



ei 



e-2 



# which is not bisimilar to As. 



ei / ei 

e2 



ei \ ei 
\ \ 



The automaton A s : # a a # with E = E 1 U P 2 , Pi = {a, ex}, E 2 



<-2 

e2 



{a,e 2 }, Pi(A s ): • • and P 2 (A 5 ): . • — • is an exam- 



ple of an undecomposable automaton that violates both DC3 and DCA. It violates PC3 since 
8\\{zq, eiae 2 y. in Pi(As)||P 2 (As), but ->5(q , exae 2 )\ in As, and it does not satisfy DCA since 
P2(As) is nondeterministic and is not bisimilar to a deterministic automaton, leading to a string 
in Pi(As)||P 2 (As) that e 2 is disallowed after a while there in no such restriction in As. If As 
was A s : 61 • • • , then P 2 (A S ) ^ • • • , and 



A 5 was decomposable. 

Remark 2: Example [8] also shows that the determinism of A s does not reduce the bisim- 
ulation synthesis problem to language equivalence synthesis problem. Note that here, As and 
Pi (As) 1 1 P 2 (As) are language equivalent, but not bisimilar. The reason is that although As is 
deterministic, and A s -< Pi(As)\\P 2 (A s ), Pi(A 5 )||P 2 (As) -< As, the simulation relations are 
not symmetric due to existence of nondeterministic strings in Pi(As)\\P 2 (As) that can not be 
replaced by a deterministic one. The nondeterminism in Pi(As)||P 2 (As) is inherited from a 
nondeterminism in P 2 (A S ). If As was in the form of A s : e * a ~ * b ? * , 



then Pi (A s ) A 5 , P 2 (A 5 ) • • • and P 1 (A S )||P 2 (A S ) = A 



s- 



IV. Hierarchical decomposition 

The previous section showed the decomposition of an automaton with respect to the parallel 
composition and two local event sets. However, in practice, multi-agent systems are typically 
comprised of many individual agents that work as a team. The proposed procedure of decomposi- 
tion can be generalized for more than two agents. However, the problem becomes rapidly complex 
as the number of agents increases. It is then advantageous to have a hierarchical decomposition 



method to have only two individual event sets at a time for decomposition. Consider a task 
automaton A s to be decomposed with respect to parallel composition and individual event sets 

n 

E i9 i — 1, 2, n, so that E = U E*. We propose the following algorithm as a sufficient condition 

i=l 

for hierarchical decomposition of the given task automaton. 
Algorithm 1: (Hierarchical Decomposition Algorithm) 

n 

1) E= U E { , E = {E 1 , E n }, K = {1, n}. 

1 = 1 

2) i — 1, find k e K such that Sj = £ fc G S, S, = U E 1 ,-, so that A s satisfies 

jeK\k 

decomposability conditions DCl-DCA in Theorem [U i.e., A s = P^(As)\\PxX A s) ■ 

3) K = K\k, S = {^} je x, A 5 = i^(A s ), z = % + 1, go to Step 2. 

4) Continue until i = n — 1 or no more decomposition is possible in % — m — 1, m < n. Then 
S m = E m _i, and hence, As is decomposable with respect to parallel composition and 
natural projections into {Si, • • • , S m } C £, if the algorithm proceeds up to % — m — 1. 

Remark 3: The algorithm will terminate due to finite number of states and local event sets. 
If the algorithm successfully proceeds to step n—1, the automaton As is decomposable and we 
obtain a complete decomposition of the global specifications into subtasks for each individual 
agent. However, it is unclear whether the algorithm can successfully terminate for any decom- 
posable task automaton (necessity). The computational complexity of the algorithm in the worst 
case is of order 0(n 2 (\E\ 2 x \Q\ x k+ E \p a (L(As))\ 2 )), where k = max \t\, assuming 

aeE 1 C\E 2 teL(A s ) 

the number of appearing events as the length of loops. In practice, during the iterations, | _ZE7 1 is 

\K\ 

replaced by U Ej which is decreasing with respect to iteration. Moreover, the second term in 
the complexity expression shows that the less number of common events and the less appearance 
of common events in As, the less complexity. 

Once the subtasks are obtained, the next step is the design of controllers for each agent 
to achieve these subtasks respectively. The following result shows that the fulfillment of the 
decomposed subtasks will imply the global specifications for the multi-agent systems. Before 
stating the theorem, following two lemmas are presented to be used for the proof. 

Lemma 4: 

P*Ms) II P*Ms) II ••• II P* m -Ms) || P* m {A s ) = 
PzMs) II {P^(As) II (•••II {P^As) || Px m (A s )))) 



Proof: See the proof in the Appendix. ■ 
Lemma 5: If two automata A 2 and A 4 (bi)simulate, respectively, A\ and A 3 , then A 2 \\ A 4 
(bi)simulates A\ || A 3 , i.e., 

1) {Ax ■< A 2 ) A (A 3 ■< A 4 ) => (Ax || A 3 ■< A 2 \\ A 4 ); 

2) (Ax A 2 ) A (A 3 A 4 ) => (Ax || A 3 A 2 || A 4 ); 

Proof: See the proof in the Appendix. ■ 

n 

Theorem 2: Consider a plant, represented by a deterministic parallel distributed system A a = || 

i=i 

A Pi , with given local event sets E,- t , % = l,...,n, and given specification represented by a 

n n 
deterministic decomposable automaton A s = || Pi(A s ), with E = U E^. If the Algorithm 

i=i i=1 
[T] continues up to i = n — 1, then designing local controllers Aq, so that A Ci \\ A Pi = Pi(As), 

i = 1, 2, • • ■ , n, derives the global closed loop system to satisfy the global specification A s , in 

n 

the sense of bisimilarity, i.e., || (A Ci \\ A P .) = A s . 

i=l 

Proof: Algorithm \T\ is a direct extension of Theorem \T\ combined with Lemma |H Then, 
choosing local controllers A Ci , so that A Ci \\ A P . = Pi(A s ), i = 1, 2, • • ■ , n, due to Lemma [5]2 

n n 

leads to || (Ac, \\ A Pi ) = \\ Pi(A s ) = A s . ■ 

i=l i=l 

Now, if DC1-DCA is reduced to DC1-DC3 (Theorem \T\ is reduced into Lemma [2]), then 

n n 

| Pi(A s ) = A s is reduced into || Pi(A s ) -< A s , and hence, choosing local controllers A Ci , 

1=1 8=1 

n n 

so that A Ci || A Pi -< Pi(As), i = 1,2, • • • ,n, due to Lemma [5ll leads to || || A Pi ) -< \\ 

i=l i=l 

Pi(A 5 ) -< A s . Therefore, 

Corollary 1: Considering the plant and global task as stated in Theorem [2l if DC1-DCA is 
reduced to DC1-DC3 in Algorithm \T\ and it continues up to i = n — 1, then designing local 
controllers Ac,, so that || A Pi -< Pj(As), z = 1,2, •■■ derives the global closed loop 

n 

system to satisfy the global specification A s , in the sense of similarity, i.e., || (A Ci \\ A P .) -< A s . 

i=i 

Remark 4: It should be noted that in this approach, the parallel composition requires a fixed 
communication pattern among the "local" automata to synchronize on their common events. This 
framework is therefore suitable for static distributed systems. For moving agent systems, the 
agents are required to provide large enough communication range to ensure that the connectivity 
is preserved during the movement, to ensure the correct synchronization on the common events. 



V. Example 

Consider a cooperative multi-robot system (MRS) configured in Figured] The MRS consists of 
three robots R\, R 2 and R 3 . All robots have the same communication and positioning capabilities. 
Furthermore, the robot R2 has the rescue and fire-fighting capabilities, while R\ and R3 are 
normal robots with the pushing capability. Initially, all of them are positioned in Room 1. Rooms 
2 and 3 are accessible from Room 1 by one-way door D 2 and two-way doors Di and D 3 , as 
shown in Figure [TJ All doors are equipped with spring to be closed automatically, when there 
is no force to keep them open. 




Fig. 1. The environment of MRS coordination example. 

Assume that Room 2 requests help for fire extinguishing. After the help announcement, the 
Robot R 2 is required to go to Room 2, urgently from D 2 and accomplish its task there and come 
back immediately to Room 1. However, D 2 is a one-way door, and, Di is a heavy door and needs 
cooperation of two robots Ri and R 3 to be opened. To save time, as soon as the robots hear the 
help request from Room 2, R 2 and R 3 go to Rooms 2 and 3, from D 2 and D 3 , respectively, and 
then Ri and R 3 position on D\, synchronously open D\ and wait for accomplishment of task 
of R 2 in Room 2 and returning to Room 1 (R 2 is fast enough). Afterwards, Ri and R 3 move 
backward to close D\ and then R 3 returns back to Room 1 from D 3 . All robots then stay at 
Room 1 for the next task. 

These requirements can be translated into a task automaton for the robot team as it is illustrated 
in Figure |2l defined over local event sets E\ = {hi, RitoDi, R 1 onD 1 , FWD, Diopened, R 2 inl, 



BWD, Dydosed, r}, E 2 = {h 2 , R 2 to2, R 2 in2, Dyopened, R 2 tol, R 2 inl,r}, and E 3 = {h 3 , R 3 to3, 
R 3 in3, R 3 toDy, R 3 onDy, FWD, Dyopened, R 2 inl, BWD, Dydosed, R 3 tol, R 3 inl, r}, with hi = 
Ri received help request, i = 1,2,3; Rjto Di=command for Rj to position on D ± , j = 1,3; 
RjOnDi = Rj has positioned on D-y, j = 1, 3; FWD:= command for moving forward (to open 
Di); BWD:= command for moving backward (to close Dy) ; Dyopened:= D x has been opened; 
Didosed:= Dy has been closed; r:= command to go to initial state for the next implementation; 
Ritok:= command for Ri to go to Room k, and Riink:= Ri has gone to Room k, i = 1,2,3, 
k = 1,2,3. 



Rzinl T h,2 



R 3 tol 




DiClosed 



BWD 



RzonDi 




FWD 



R 2 tol 



Diopened 



Fig. 2. Task automaton As for robot team. 



The states show the labels of transitions after occurrence, and hence are not labeled, here. 
Meaning that 5(x, e) = y is interpreted as follows: Once e occurs in x, it transits into y and this 
state y is labeled by e(occurred). For example, when "help request" event happens, the state of 
each robot transits from the initial state to the state "the robot received help request". 



We check decompos ability condition for this global task automaton with respect to Si = P 2 
and Ei = EiUE 3 for the first stage in Algorithm 1. Firstly, {h 2 , R 2 to2, R 2 in2} = Ei\Ei can oc- 
cur in any order with respect to {hi, RitoD 1 , RionDi, h 3 , R 3 to3, R 3 in3, R 3 toD 1 , R 3 onDi, FWD} 
= Ei\Ei, as it is shown in the global automaton in Figure[2l satisfying DC\ and DC2. Moreover, 
Diopened, R 2 inl and r are common events, provided by P 1; R 2 and R 3 , respectively, and 
informed to the other two robots upon occurrence. 

Since {Diopened, FWD} C Ei, {R 2 in2, Diopened} C Ei, {D\ opened, R 2 tol} C Ei, 
{R 2 tol, R 2 inl} C Ei, {R 2 inl,BWD} C E ls {BWD,D closed} C E 1; {D lC losed, R 3 tol} C 
Ei, {P 3 tol,P 3 ml} C E x , {P 3 ml,r} C Ei, {r,hi} C E 1; {r,/i 2 } C E x , {r,/i 3 } C E l5 and 
hence all these successive transitions satisfy DC\ and DC2. Furthermore, all common events 
{Diopened, R 2 inl, r} C EjflEi appear in only one branch, and hence, DC3 is satisfied. Finally, 
-Psi (^4s) and Pg a (As) are both deterministic, and hence, DC A is satisfied. 

Therefore, due to TheoremCD A s can be decomposed into P 2 (A S ) = (As) = A 2 and P ii3 = 
P^As). The second stage of hierarchical decomposition, decomposes P 13 (y4 s ) into Ai = 
P\(As) and A 3 = P 3 (As). The private transitions defined over Ei\E 3 = {hi, R\toDi, RionDi] 
can occur in any order with respect to the transitions defined over the private local event set 
E 3 \E t = {h 3 , R 3 to3, R 3 in3, R 3 toD u R 3 onD{\. Since {P 3 on£>i, FWD} C E 3 , {R l0 nD x , FWD} 
C P 1? {FWD,D l0 pened} C P x n P 3 , {D l0 pened, i? 2 ml} C^n P 3 , {i^ml.WD} C 
Pi n P 3 , {BWD, D lC losed} C P x n P 3 , {D lC losed, R 3 tol} C P 3 , {P 3 tol,P 3 ml} C P 3 , 
{P 3 ml, r} C P 3 , {r, /i 3 } C P 3 and {r, /ix} C P x , then PCI and PC2 are satisfied. Furthermore, 
since all common events {FW D , Diopened, R 2 inl, BW D , Didosed,r} C P x n P 3 appear in 
only one branch in Pi )3 (AsO, therefore, there are no pairs of strings violating DC3, and hence, 
DC3 is also satisfied. Moreover, Pi(As) and P 2 (A S ) are both deterministic, and consequently, 
-Pi^As) satisfies PC4. The results of two decomposition stages are shown in Figures [3] and HI 
such that P 1 (A S ) || P 2 (A S ) || P 3 (A S ) = A s . 

It can be seen that the design of supervisor to satisfy these individual task automata is easier 
than the design of a global supervisor to satisfy the global specification. Furthermore, since the 
specification is determined for each agent, the global task can be achieved in a decentralized 
fashion. 

Discussions on the design of supervisory control (for local local plants and local task automata) 
and also refining of the low level continuous controllers can be found in 0TJ, |[T2l|. Il23l . |[24| 
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Fig. 3. P 2 (A S ) for R 2 and P {Ei ue 3 }(As) for the team {Ri,R 3 }. 
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Fig. 4. Pi (As) for Ri; P 2 (A S ) for R 2 and P 3 (A S ) for R 3 . 



and [H. 

This scenario has been successfully implemented on a team of three ground robots, shown in 
Figure [Q 



VI. Conclusion 

The paper proposed a formal method for automaton decomposition that facilitates the top- 
down distributed cooperative control of multi-agent systems. Given a set of agents whose logical 
behaviors can be modeled as a parallel distributed system, and a global task automaton, the paper 
has the following contributions: firstly, we have provided necessary and sufficient conditions for 
decompos ability of an automaton with respect to parallel composition and natural projections 
into two local event sets; secondly, the approach has been extended into a sufficient condition 
for an arbitrary finite number of agents, using a hierarchical algorithm, and finally, we have 
shown that if a global task automaton is decomposed into the local tasks for the individual 
agents, designing the local supervisors for each agent, satisfying the local tasks, guarantees that 
the closed loop system of the team of agents satisfies the global specification. 

The implementation of this approach is decentralized, in the sense that there is no central 
unit to coordinate the agents; however, they need communication to synchronize on common 
events. This approach differs from the classical decentralized supervisory control that refers to 
the configuration of a monolithic plant, controlled by several supervisors that are distributed 
into different nodes ifTTll . The proposed approach is more suitable for those applications with 
distributed configurations for both plant and supervisor, such as multi-robot coordination systems 
and sensor/actuator networks. In addition, due to associativity property of parallel composition, 
the proposed approach can be modular such that when a new task automaton is introduced to the 
systems, one can decompose the new global task automaton, and then compose the new local 
task automata with the corresponding old local task automata. 

VII. Appendix 

A. Proof for Lemma [7] 

We prove A s -< P 1 (A S )\\P 2 (A S )) by showing that R = {(q, z) G Q x Z\3s G E*, 5{q , s) = 
q, z = ([q]x, [9)2)} is a simulation relation, defined on all events in E and all reachable states in 
A s . Consider A s = (Q, q , E = E 1 UE 2 , 6), P^As) = {Qi, g°, E h Si), 1 = 1, 2, P X {A S ) \ \P 2 {A S ) = 
(Z, z , E,S\\). Then, Vg, q' G Q,e G E, 5(q, e) = q' , according to definition of natural projection 

5i([q]i, e) if e G Ei, 

(Definition [101) [q ]i = < , i — 1, 2, and due to definition of parallel compo- 

[Q)i ife^E, 



sition (Definition|7]) <Jii(([g]i, [g] 2 ),e) = ([q% [q'\ 



(6i([q]i,e),5 2 ([q] 2 ,e)), if e G P x n P 2 ; 

(S 1 ([q} 1 ,e),[q} 2 ), if e G E t \E 2 ; 

{[q)iM[qh,e)), if ee E 2 \E X . 

This is true for any q E Q, particularly for q . This reasoning can be repeated for any reachable 

state in Q. Therefore, starting from q and taking (q Q , Z = ([qo]i, [qoh)) G R> from the above 

construction, it follows that for any reachable state in Q (3s G E*,5(q ,s) = q) and q' G Q, 

e G E, 5(q,e) = q', there exists z = ([q)i, [9] 2), z' = ([q')i, [q'] 2 ) such that 5(z, e) = z', and we 

can take (q,z) G P and (q',z') G P. Therefore, R = {{q,z) G Q x Z|3s G P*, 5(g , s)\, z = 

([q)i, [<?] 2 )} is a simulation relation, defined over all e £ E, and all reachable states in As, and 

hence, A s ^ Pi{A s )\\P 2 {A s ). 

B. Proof for Lemma [2] 

We use two following lemmas during the proof. 

Lemma 6: Consider a deterministic automaton As = (Q,qo,E — E\ U E 2 ,5). Then PCI A 
DC2 [Vs G P*, 5(q ,s)\ 5(q , Pl (s)\p 2 (s))\ in A s . 

This lemma means that for any transition defined on a string in As, all path automata defined 
on the interleaving of Pi(s) and p 2 (s) in Pi(A s )\\P 2 (A s ) are simulated by A s , provided DC1 
and DC2. 

Proof: Consider a deterministic automaton As = (Q, qo, E — Ex U £2, 5), a string s G P*, 
%o,s) = q, and its projections p^s), p 2 (s) with tfi(xo,j?i(s)) = x, S 2 (y ,p 2 (s)) = y and 
(x,y) G <J||((ar ,J/o),Pi(s)|p2(s)). in Pi(A s ), P 2 (A S ) and P 1 (A 5 )||P 2 (A 5 ), respectively. Any 
string s can be written as s = wY- ^7^, with w fc G [P\(Pi n E 2 )]*, 7 fc G (Pi n E 2 )*, 
p l (u k ) = a k = ag...a* fc , "o = £ > P2<w fc ) = /3 fc = Po-~Pn k > = £ > Pi(l k ) = P^) = 
l k — 7o—7r fe ' 7o = £ - The case m fc = 0, n fc = 0, r fc = 0, K = 0, results in pi(io k ) = e, 
p 2 (u! k ) = e, ^ k = e and s — e. Based on this setting and definition of parallel composition, for 
k — 0, K, i = 0, m fc , j = 0, n k and r = 0, r k , the interleaving £>i(s)|p 2 (s) is evolved 



in Pi(A 3 )\\P 2 (As) as follows: V(x k+i ,y k+j ) G <2ixQ 2 : £||((aJ*+i» Vk+j), af)=(5i(x fe+ i, af), y fe 
5||((5i(a; fc+i , aj), y fc+ j), /3^)=((5i(x fc+i , af ), <5 2 (2/*+j, (3 k )), 5\\((x k+i , y k+j ), (3 k )={x k+i , 5 2 {y k+j , (3 k )), 
S\\((x k+i , 5 2 (y k+j , /3 k )), a k )=(5 1 (x k+i , a k ), 5 2 (y k+j , f3 k )), 5\\{(x k+mk+rj y k+nk+r ),-y k )) = 

{bi{x k+mk+r ,%),5 2 (y k+nk+r ,X)) with <5i(x fe+i ,af) = { , 5 2 (y k+j ,f3 k ) = 

x k+i+1 if oq ^ £ 



< 3 and {5 l {x k+mk+r ,^),5 2 {yk+n k +r,1r)) = 

I Vk+j+i if 0* ^ e 

I (Xk+m k +r, Vk+n k +r) lf^ = £ 

I ^k+m k +r+ l,yk+n k +r+l) tflr7^ £ 

Moreover, DC1 and DC2 collectively imply that Vei G E X \E 2 , e 2 G E 2 \E X , q G Q, [5(q, e{)lA 
5(q, e 2 )!] V <5(g,eie 2 )! V <5(g,e 2 ei)! =>■ <5(g,eie 2 )! A 5(g,e 2 ei)! which particularly means that 
Vk G {0,-K}, Va$,0},qi d G Q, % = 0,...,m fc , j = 0,...,n fc , r = 0, ...,r fc : % fe+ijfe+i , af/3j=)! A 
5(g fc +i,fc+i, P}<4)\ with a simulation relation i?(w fe ) = {((x h +i, (5i(x fc+i , a*), ifc+j), 

<5(g fc+i ,*+iJ of)), ((a5 fc+ i, S 2 (y k+j , ^)),S(q k+ijk +j, P})), (,(S 1 (x h+i , a£), S 2 (y k+j , P})), ^fe+^+j, 

((^(arfc+i, of), 5 2 (y k+j , p$)),8(q k+i ^ k+j , /9faJ))} from transitions defined onp 1 (w fc )|p 2 (w /c ) 
into As. For the transitions on the common events, the evolutions are 5(gfc +mfc+n fc +nfc+r , 7r )! in 
A 5 for r = 0, r fc , leading to simulation relation P(7 fc ) = {((a; fc+mfc+r , y fc+nfc+r ),g fc+mfc+ri/c+rifc+r ), 
((5i(x fe+mfc+r .,7^),5 2 (y fc+nfc+r .,7^)), 5(g fc+mfc+r . ifc+nfc+r ., 7*))} from transitions on Pi(7*)|p 2 (7 fc ) 

K 

into As. Therefore, for i — 0, m*., j = 0, n*., r = 0, r^, i? = U R{u ) U P(7 ) defines 

fc=0 

a simulation relation from PA(z , pi(s)\p 2 (s)) (in Pi(As)||P 2 (As)) into As. ■ 
Lemma 7: If DCl and PC2 hold true, then Vs, s' G P*, <5(g , s)!, 5(go, s')!, s ^ s', PE 1 nE 2 ( s )> 
PE 1 nE 2 ( s ') do not start with the same a G E\ HP 2 , then 5(q ,pi(s)\p 2 (s'))\ A 5(q , p 1 (s')\p 2 (s))\ 
in A 5 . 

Proof: The antecedent of Lemma [7] addresses three following cases: (Case 1): s = u\, 
s' = u)[; (Case 2): s = Uiau 2 , s' = u[, and (Case 3): s = Uiau 2 , s' = uj^bu^, where, Ui,u[ G 
[P\(Pi n E2)]*, tu 2 , u' 2 G (Pi U E 2 )\ a, b G E 1 n P 2 . 

For Case 1, setting P = 1, r k = 0, taking pi(wi) = a = a ...a m G (Pi\P 2 )*, p 2 {u[) = 
(3' = /3' .../3' n , G (P 2 \Pi)*, piK) = a' = «(,...<, G (Pi\P 2 )* and p^) = /3 = /3 .../3„ G 
(P 2 \Pi)*, similar to the first part of Lemma [6l it follows that 5(qo,pi(uJi)\p 2 (u' 1 ))\ and 
*(?o,Pi(wi)|p2(wi))! in A s . 

For Case 2, from Case 1 and Lemma[6]it follows that 5(g , pi (s)|p 2 (s'))! = <5(g , [pi(^i) |P2(^)] 
opi(w 2 ))! and %o,Pi(s')|P2(s))! = %o, [pi(^i)|P2(^i)]aP2(w 2 ))! in A s . 

For the third case, from definition of parallel composition combined with the first two cases and 
also Lemma[6l 5(go,Pi(s)|p 2 (s'))! leads to 5(q , [pi(wi)|p 2 (a;i)]a[pi(a; 2 )|p 2 (a; 2 )])! and5(g , [Pi(^i)| 
p 2 (c^)]%i(w 2 )|p 2 (u; 2 )])! in A s and similarly, % ,Pi(s')|P2(s)) ! results in 5(q , [pi(o;i)|p 2 (a;i)] 
o[PiM|P2(w 2 )])! and % , [pi(o;i)|p 2 (a; 1 )]6[pi(a; 2 )|p 2 (a; 2 ))])! in A s . 



Therefore, for all three cases, S(q ,pi(s)\p 2 (s'))\ in A s and 8(q ,pi(s')\p 2 (s))\ in A s . ■ 

Now, Lemma [2] is proven as follows. 
Sufficiency: The set of transitions in P 1 (A S )\\P 2 (A S ), is defined as T = {(x ,y ) — > 
(x,y) G Qi x Q 2 }, where, (x ,y ) Pl(s ^ s } hi Pi(A s )||P 2 (^s) is tne interleaving 

of transitions x x in P^As) and a transition y ^A- ?/ in P 2 (As) (projections of 

s s' 

transitions q — > q and q — > q , respectively, in A s ). T can be divided into three sets 
of transitions corresponding to a division {ri,r 2 ,r 3 } on the set of interleaving strings T = 
{Pi(s)\p 2 (s')\q -A q,qo g',?,?' e Q,s,s' G P*}, where, I\ = { Pl (s)\p 2 (s') G I> = s'}, 
F 2 = {pi(s)\p 2 (s') G T\s 7^ s'^^nEal 5 ) an d PEin^ 5 ') do not start with the same event}, and 
T3 = {pi(s)\p 2 (s') G r|s 7^ s / ,^K 1 nB 2 ( s ) an d PEin^l- 5 ') start w i tn tne same event }. 

Now, for any s, s', 6(q ,s)\, 5(q ,s')\, in A s , both 5(q ,p 1 (s)\p 2 (8 , ))\ and 5(q ,pi(s')\p 2 (s))\ 
are guaranteed, for Ti, due to Lemma|6l for T 2 , due to Lemma[71 and for T 3 , due to combination 
of DC3 and Lemma |6] (For simplification, in DC3, s and s' can be started from any q, instead 
of q , and the strings between q and q are checked by Lemma |6]). 

Necessity: The necessity is proven by contradiction. Suppose that As simulates Pi(As) \\P 2 (As), 
but 3ei G E 1 \E 2 ,e 2 G E 2 \E x ,q e Q,s e E* s.t. (1): [<%ei)l A%e 2 )!] A -.[%, eie 2 )! A 
e 2 ei)!]; (2): ->[S(q, eie 2 s)! <5(g, e 2 eis)!], or (3): 3s, s' G E*, sharing the same first 
appearing common event a G Pi fl P 2 , s ^ s', q E Q: 5(q, s)\ A <5(g, s')! A ~ i [5(q , ,Pi(s)|p2(s'))! A 
*(?,Pi(«0|pa(a))l]. 

In the first case, due to definition of parallel composition, the expression [5(q, ei)\ A 5(q, e 2 )!] 
leads to 5\\(z, eie 2 )! = e 2 ei)!, where 2; G Qi x Q 2 in P^A^I^^s) corresponds to g G Q 
in v4 s . Therefore, ^(z, eie 2 )! A <5|| e 2 ei)!, but, -<[5(q, e\e 2 )\ A S(q, e 2 ei)!]. This means that 
Pi(^45)||P 2 (A,s) ^ y4 5 which is a contradiction. The second case means 3e x G E 1 \E 2 ,e 2 G 
P 2 \Pi, q e Q,s e E* s.t. [<5(g, eie 2 s)! V5(g, e 2 eis)!] A -i[<5(g, eie 2 s)! A5(g, e 2 eis)!]. From defini- 
tion of parallel composition, then 5(q, eie 2 s)\\/S(q, e 2 e\s)\ implies that 5\\(z, e\e 2 )\ = 5\\(z, e 2 ei)!, 
for some z E Qi x Q 2 corresponding to q G Q. Consequently, from definition of transition 
relation and A s -< Pi(A s )\\P 2 (A s ) it turns to 8\\{z,e\e 2 s)\ = 8\\(z, e 2 eis)!, meaning that 
5\\(z, e\e 2 s)\ A 5\\(z,e 2 eis)\, but, ~>[5(q, e\e 2 s)\ A 5(q, e 2 eis)!]. This in turn contradicts with 
the similarity assumption of Pi(As)\\P2(As) -< As- The third case also leads to the con- 
tradiction as causes the violation of the simulation relation from Pi(As)\\P 2 (A s ) into A s as 
S(q,s)\A5(q,s')\ leads to 5\\(z,pi(s)\p 2 (s'))\ A S\\(z,p 2 (s)\pi(s'))\ in P 1 (A 5 )||P 2 (A 5 ), whereas 



^[6(q,p 1 (s)\ P2 (s'))\A8(q, P2 (s)\ Pl (s>m. 



C. Proof for Lemma \3\ 

To prove Lemma [3l we use following two lemmas together with Lemma [5l Firstly, the 
following lemma is introduced to characterize the symmetric property of simulation relations. 

Lemma 8: Consider two automata Ax and A 2 , and let A\ be deterministic, A\ -< A 2 with the 
simulation relation Rx and A 2 -< Ax with the simulation relation R 2 . Then, R± 1 = R 2 if and 
only if there exists a deterministic automaton A\ such that A[ = A 2 . 
Proof: 

Sufficiency: A 1 -< A 2 , A 2 -< A 1 and A[ = A 2 , collectively, result in A 1 -< A[ and A[ -< A u 
that due to determinism of Ax and A[ lead to Ax = A[. Finally, since A[ = A 2 , from transitivity 
of bisimulation, A 1 = A 2 , and consequently, R^ 1 = R 2 . 

Necessity: The necessity is proven by contradiction as follows. Consider two automata A x = 
(X, x , E, Si), A 2 = (Y, 7/0, E, S 2 ), let A\ be deterministic, Ay -< A 2 with the simulation relation 
Ri, A 2 -< A\ with the simulation relation R 2 and suppose that R[ l = R 2 (and hence A\ = A 2 ), 
but there does not exist a deterministic automaton A[ such that A[ = A 2 . This means that 
3s e E*, a e E, y u y 2 e Y, 5 2 (y , s) = y lt S 2 (y ,s) = y 2 , 5 2 {y x ,(j)\, but ^5 2 (y 2 , a)\. From 
A 2 -< A 1} 5 2 (y , s) = 7/i A5 2 (yx, cr)\ implies that 3xx Gl, 5x(x ,s) — XiASx(xx, a)\. On the other 
hand, Ax is deterministic, and hence, Vx 2 G X, Sx(x , s) = x 2 x 2 = xx- Therefore, A 2 -< Ax 
necessarily leads to (y 2 ,Xx) G R 2 . But, 3a G E such that 5\(xi,a)\ A ->8 2 (y 2 , a)\, meaning that 
(y2,xi) G R 2 A -i(xi,t/ 2 ) ^ -Ri, i.e., -R^" 1 ^ R 2 , that contradicts with the hypothesis, and the 
necessity is followed. ■ 
Next, let Ax and A 2 to be substituted by A s and Pi(A s )\\P 2 (A s ), respectively, in Lemma [U 
Then, the existence of A[ = A' s in Lemma [8] is characterized by the following lemma. 

Lemma 9: Consider a deterministic automaton As and its natural projections Pi(As), i = 1, 2. 
Then, there exists a deterministic automaton A' s such that A' s = Px(As)\\P 2 (As) if and only if 
there exist deterministic automata P-(A S ) such that P-(A S ) = Pi(A s ), i = 1,2. 

Proof: Let A s = (Q, q , E = ExUE 2 , 5), P t (A s ) = (Q h q*, E i: 5 t ), P((A S ) = (<& q' -, E i: 
i = 1,2, Px(A s )\\P 2 (A s ) = {Z.z^E^w), P[{A S )\\P^A S ) = (Z', z' , E, 5^). The proof of 
Lemma [9] is then presented as follows. 



Sufficiency: The existence of deterministic automata P[(As) such that P((As) = Pi(A s ), i = 
1, 2 implies that 5[ and 5' 2 are functions, and consequently from definition of parallel composition 
(Definition Q, 61 is a function, and hence P[(As)\\P 2 (A s ) is deterministic. Moreover, from 
LemmaEl P[{As) = Pi(A s ), i = 1,2 leads to P[(A S )\\P^A S ) = Pi(A s )\\P 2 (A s ), meaning that 
there exists a deterministic automaton A' s = P[(A S )\\P 2 (A S ) such that A' s = P 1 (A S )\\P 2 (A S ). 

Necessity: The necessity is proven by contraposition, namely, by showing that if there does 
not exist deterministic automata P((As) such that P((As) = Pi(As), for i = 1 or i = 2, then 
there does not exist a deterministic automaton A' s such that A' s = Pi(As)\\P 2 (As). 

Without loss of generality, assume that there does not exist a deterministic automaton P[{Ag) 
such that P[(A S ) = Pi(A s ). This means that 3q,q 1 ,q 2 G Q, e G E x , t 2 G (E 2 \E 1 )*, t G E*, 
6(q,t 2 e) = qi, 6(q,e) = q 2 , ->(6(qi,t) = q 2 <^> 6(q 2 ,t)\), meaning that 5(q 1 ,t)\ A ^6(q 2 ,t)\ or 
->5(qi,t)\ A 6(q 2 ,t)\. Again without loss of generality we consider the first case and show that 
it leads to a contradiction. From the first case, 5(qi,t)\ A -^6(q 2 ,t)\, and definition of natural 
projection, it follows that ^([gj^e) = [g x ]i, 5i([gi]i,pi(t))!, 5 1 ([q] 1 ,e) = [q 2 ] u -i5i([g 2 ]i,pi (*))!, 
^([?]2,p 2 (e)) = [g 2 ] 2 , ^ 2 ([g 2 ] 2 ,p 2 (t))!, and hence, S\\(([q] u [q] 2 ),e) = ([gi]i, [gi] 2 ), 5]|(([gi]i, [gi] 2 ), 
Pl (*))!, whereas 5||(([g]i, [g] 2 ), e) = ([gi] 1; [g 2 ] 2 ), ^S ]l (([q 1 ] 1 ,[q 2 } 2 ), Pl (t))\ in P^AsW^As), 
implying that there does not exist a deterministic automaton A' s such that A' s = Pi (745)1^2(^45), 
and the necessity is proven. ■ 

Now, Lemma [3] is proven as follows. 

Sufficiency: DCA implies that there exist deterministic automata P[(As) such that P-(As) = 
Pi(A s ), i = 1,2. Then, from Lemmas [5] and [H it follows, respectively, that P{(A S )\\P 2 (A S ) = 
Pi(As)\\P 2 (As), and that there exists a deterministic automaton A' s = P{(As)\\P 2 (As) such 
that A' s = Pi(A s )\\P 2 (A s ) that due to Lemma [8l it results in R^ 1 = R 2 . 

Necessity: Let As be deterministic, As -< Pi(As)\\P 2 (As) with the simulation relation Ri 
and Pi(As)\\P 2 (As) -< A s with the simulation relation R 2 , and assume by contradiction that 
R^ 1 = R 2 , but DCA is not satisfied. Violation of DCA implies that for i = 1 or i = 2, there 
does not exists a deterministic automaton Pl(As) such that P((As) = Pi(As). Therefore, due to 
Lemma |9l there does not exist a deterministic automaton A' s such that A' s = Pi(As)\\P 2 (A s ), 
and hence, according to Lemma [8l it leads to R^ 1 7^ R 2 which is a contradiction. 



D. Proof for Lemma 

Lemma |4] comes from the associativity property of parallel decomposition |fTTfl as for automata 

A, i = 1, m: A 1 \\ A 2 \\ ■ ■ ■ \\ A m _ x \\ A Em = A 1 || (A 2 || (• • • || (An-i II A m ))). 

E. Proof for Lemma \5\ 

Lemma \5\l is proven by showing that the relation R = {((gi,^), (g 2 , ^4) ) | (<?i, g 2 ) G R\ and 

(53,^4) G R 2 } is a simulation relation, where, Ri and R 2 are the respective simulations from 

Ai to A 2 and from A 3 to A*. 

Consider A { = {Q h qlE h 5i), i = 1,..,4, A X \\A 3 = (Q 1>3 , (g?, gg), £ = £1 U 4^1,3), 

A 2 ||A 4 = (Q 2 ,4, (g 2 °, g 4 °), E = E 2 U Ei, 8 2A ), E l = E 3 and £ 2 = £ 4 . Then, V(g 1; g 3 ), (gi, g 3 )' G 

<3i j3 , e e E, q 2 e Q 2 , g 4 G Q 4 such that 5i, 3 ((gi, gs), e) = (gi,g 3 )', (gi,g 2 ) G i?i and (g 3 ,g 4 ) G 

i? 2 , according to definition of parallel composition (Definition [7]), we have (gi,g 3 )' = (gi,g 3 ) = 

(5i(gi, e), <5 3 (g 3 , e)) , if 5i(gi, e)!, <5 3 (g 3 , e)!, e G £1 n £ 3 ; 

(5i(gi, e), g 3 ) , if 6 x (gi, e)!, e G £i\£ 3 ; 

(gi, <5 3 (g 3 , e)) , if <5 3 (g 3 , e)!, e G £ 3 \£i; 

and due to definition of simulation (Definition [5]), Ai -< A 2 and A 3 -< A 4 , it follows that 

3g,' G Qi, 5i{q h e) = g<, z = 2, 4 if e E E 2 D E 4 
3g 2 G Q 2 , 5 2 (g 2 , e) = q' 2 if e G £ 2 \£ 4 

3g 4 G Q 4 , 5 4 (q 4 , e) = g 4 if e G E 4 \E 2 

This, in turn, due to definition of parallel composition implies that 3(g 2 , g 4 ) G Q 2 ,4 such that 

(<5 2 (g 2 ,e),5 4 (g 4 ,e)) , if e G £ 2 n E 4 ; 

(5 2 (g 2 , e), g 4 ) , if e G E 2 \E 4 ; 

(g 2 ,&t(g4,e)) , if e G E 4 \E 2 . 

Therefore, V(gi, g 3 ), (gi, g 3 )' G Qi i3 , (g 2 , g 4 ) G Q 2 , 4 , e G £, such that 5i, 3 ((gi, gs), e) = (gi, g 3 )' 

and ((gi, g 3 ), (g 2 , g 4 )) G R, then 3(g 2 , g 4 )' G Q 2)4 , 5 2j4 ((g 2 , g4), e) = (g 2 , g 4 )', ((gi, g 3 )', (g 2 , g 4 )') G 

R. This together with ((g?,g 3 ), (g 2 ,g^)) G R, by construction, leads to Ai\\A 3 -< A 2 \\A 4 . 

Now, to prove Lemma 0.2, we define the relation R = {((g 2 ,g 4 ), (gi, g 3 ))|(g 2 , gi) G -Ri and 

(g4, gs) G -R 2 }, where, Ri and R 2 are the respective simulation relations from A 2 to A x and from 

A 4 to A 3 , and then similar to the proof of the first part, we show that R is a simulation relation. 

Now, to show that A^As = A 2 ||A 4 it remains to show that V(gi,g 3 ) G Qi j3 , (q 2 ,q 4 ) G Q 2)4 . 

((gi, gs), (g2) g4)) E R ((g 2 ,g4), (gi,gs)) G -R. This is proven by contradiction. Suppose 

that 3(gi,g 3 ) G Qi, 3 , (g 2 , g 4 ) G Q 2 ,4 such that ((g ls g 3 ), (g 2 , g 4 )) ERA ((g 2 , g 4 ), (gi, g 3 )) ^ 



<M(g 2 ,g4),e) = (g 2 ,g 4 )' 



or ((?2, 94), (91, 93)) G R! A 53), (?2, 94)) ^ -R- We prove that the first hypothesis leads 
to contradiction, and the contradiction of the second hypothesis is followed, similarly. The 
expression ((q u g 3 ), (q 2 , g 4 )) G R A ((g 2 , 54), (9i, 93)) £ R means that 3s G E 1 *, 5i, 3 ((9i, 9°), s) = 
(91,93). ^2,4((?2)?4)) s ) = (92,94), Ve G -E, 5i j3 ((gi,g 3 ),e)!: 5 2j4 ((g 2 , 94), e)!; but, 3a G E, 
^2,4((92,94),o")! A ->5i i3 ((gi,g 3 ),cr)!. From Definition U\ $2,4 ((?2, 94), c)' means that 
52(?2,o-)!, ^4 (94,0")! ifeG£ 2 n£ 4 ; 
^2(92,0-)! ifeG^ 2 \^4; 
<5 4 (94,or)! if e G £4^2- 

Consequently, from (g 2 , g x ) G -Ri and £1 = S 2 (due to Ai = A 2 ), (54, g 3 ) G -R 2 and i? 3 = E 4 (due 

^(gi, a)!, 5 3 (g 3 , a)! if e G £ 2 n E 4 = E l n 
5i(gi,a)! if e G E 2 \E 4 = E X \E 3 ; 

53(93,0)! if e e E 4 \E 2 = E 3 \E U 

that from Definition [7] leads to 5i >3 ((gi, g 3 ), cr)! which contradicts with the hypothesis and the 

proof is followed. 



to A 3 = A4), and Definition[51 it follows that < 
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